Legend:

Quite a bit has changed since we introduced off-by-default for XML-RPC. Their code has improved, and they are no longer considered second-class citizens when it comes to API development, thanks to the work of a large team of awesome contributors. Security is no greater a concern than the rest of core.

1

Quite a bit has changed since we introduced off-by-default for XML-RPC. Their code has improved, and it is no longer considered a second-class citizen when it comes to API development, thanks to the work of a large team of awesome contributors. Security is no greater a concern than the rest of core.

2

2

3

3

There is no longer a compelling reason to disable this by default. It's time we should remove the option entirely.